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EXAMINER'S AMENDMENT 

1 . An examiner's amendment to the record appears below. Should the changes and/or 
additions be unacceptable to applicant, an amendment may be filed as provided by 37 CFR 
1.312. To ensure consideration of such an amendment, it MUST be submitted no later than the 
payment of the issue fee. 

Authorization for this examiner's amendment was given in a telephone interview with 
David Pitinga on 08 December 2008. The application has been amended as follows: 

1. (currently amended) A method for evaluating contents of a message, comprising: 
characterizing a message segment, wherein the message segment further comprises a 

packet in a packet-switched network; 

scanning the message segment to define a stream of tokens associated with the message 

segment; 

associating the message segment with a meta session through the stream of tokens, 
wherein the meta session is made persistent across message transactions and different 
HTTP sessions by storing data generated by the meta session on a persistent storage 
medium; 

parsing the token stream to extract substructures according to a grammar; 
determining rules associated with the tokens, the rules when executed defining actions for 
intrusion detection and prevention; 

executing the actions associated with the message segment; and 
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queuing the message segment for transmission to a destination, wherein each of the 
operations in the method is executed by an integrated circuit. 

10. (currently amended) A computer readable media having stored computer program 
instructions for evaluating the contents of a message, comprising 

computer program instructions for characterizing a message segment, wherein the 
message segment further comprises a packet in a packet-switched network; 

computer program instructions for scanning the message segment to define a stream of 
tokens associated with the message segment; 

computer program instructions for associating the message segment with a meta session 

through the stream of tokens, wherein the meta session is made persistent across message 

transactions and different HTTP sessions by storing data generated by the meta session 

on a persistent storage medium; 

computer program instructions for parsing the token stream to extract substructures 
according to a grammar; 

computer program instructions for determining rules associated with the tokens, the rules 
defining actions for intrusion detection and prevention; 

computer program instructions for executing the actions associated with the message 
segment; and 

computer program instructions for queuing the message segments for transmission 
wherein the each of the computer program instructions in the computer readable media are 
executed by an integrated circuit. 
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Allowable Subject Matter 

2. Claims 1-16 and 18-21 are allowed. The following is an examiner's statement of reasons 
for allowance: The following is an examiner's statement of reasons for allowance: Applicants' 
remarks submitted 25 July 2008 supply sufficient reasoning for differentiating from identified 
prior art. In addition, the amendment above overcomes previous 35 USC § 101 rejections and so 
therefore are withdrawn. 

Further, remarks and amendments submitted on 25 July are also sufficient to overcome 
potential Double Patenting rejections concerning independent claims in co-pending applications 
10/753,727, 10/861,722 and 10/898,473 for the following reasons. 

Application 10/753,727 is more oriented toward rule-based processing and meta 
information based on grammar association information whereas the instant application provides 
meta session information containing rules that govern intrusion detection and protection. 

Application 10/861,722 is more related to user-controlled message content configuration 
and transmission. 

Application 10/898,473 is directed to electronic mail filtering. 

Any comments considered necessary by applicant must be submitted no later than the 
payment of the issue fee and, to avoid processing delays, should preferably accompany the issue 
fee. Such submissions should be clearly labeled "Comments on Statement of Reasons for 
Allowance." 



Application/Control Number: 1 0/753,846 Page 5 

Art Unit: 2626 

Conclusion 

3. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to JUSTIN W. RIDER whose telephone number is (571)270-1068. 
The examiner can normally be reached on Monday - Friday 6:30AM - 3:30PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, David R. Hudspeth can be reached on (571) 272-7843. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. 

For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic Business Center 
(EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer 
Service Representative or access to the automated information system, call 800-786-9199 (IN 
USA OR CANADA) or 571-272-1000. 

/David R Hudspeth/ 

Supervisory Patent Examiner, Art Unit 2626 

/J. W. R./ 

Examiner, Art Unit 2626 
17 December 2008 



